BGP neighborship with VIP on Nexus

[umeshunited]

I have two Nexus 3K in vpc and one stack (of 2switches) connected to it.

Is it possible to run bgp between a stack and Hsrp VIP on nexus?

The basic diagram is attached.

[Sergiu.Daniluk]

Hi @umeshunited 

Refer to this link for supported L3 routing over vPC topologies:

https://www.cisco.com/c/en/us/support/docs/ip/ip-routing/118997-technote-nexus-00.html 

What is relevant for your case is table 2.

Depending on the hardware (3xxxx-R, 3000/3100/3200.. , 3500), routing adjacencies over vPC peer-link is supported starting with a specific NXOS version, with the "Layer3 peer-router" configured.

Alternatively, you can use a dedicated L3 link (not the peer-link) between the two N3Ks, and you do not need the L3 peer-router option.

Stay safe!

Sergiu

[Georg Pauwen]

Hello,

on a side note, and in addition to the other post, I remember that a long time ago, it used to be not possible to use a VIP (HSRP) address as a peer address for BGP. I just tested this on newer IOS versions, and it seems to work fine.

[Sergiu.Daniluk]

Thanks with your post @Georg Pauwen  You made me realize that the question is about neighborship with VIP.

@umeshunited: I do not think establishing neighborship with VIP will work simply because both Nexus switches are active/active. So depending on the hashing of the BGP msgs/updates, the packets will be consumed by the receiving N3K, but the routing information is not synchronized between the two by vPC control plane. You will need another routing neighborship between N3Ks. However, this still doesn't look clean.

I would suggest to have two individual BGP peering sessions, to each N3K, + L3 peer-router (or a dedicated L3 link b/w N3Ks).

Cheers,

Sergiu

[umeshunited]

Can you please share any doc mentioning IOS versions supported?

I want to form only one bgp neighborship between nexus in vpc and stack switch.

Currently, I am forming two neighborship with SVI of each nexus. I tried to configure stack switch to form neighborship 

with HSRP VIP of nexus but no luck.

[Sergiu.Daniluk]

Hi @umeshunited 

Why do you want to use only one neighborship and not 2? What is the outcome/use case/advantages you are looking for?

Remember that from L2 perspective the Nexus switches are acting as one, but from a L3 perspective they are functioning individually, they both have independent control plane.

Regards,

Sergiu

[umeshunited]

Currently I have one bgp neighborship with stack1 and stack2. I am replacing stack1 with Nexus (2 nos with vpc).

So now it will be like Nexus(2 nos with vpc) on one end and stack2 on other end.

I do not want to configure second bgp neighborsip.

[Sergiu.Daniluk]

Ahh got it. Well since, from control plane perspective, the Nexus vPC does not work similar with the stack switches, you will need to configure the second BGP neighbor.

Cheers,

Sergiu

[paul driver]

Hello
Use the two physical links to peer with a local interface such a a loopback, The result will be you have just the one bgp peering but the resiliency of the two physical links

[umeshunited]

Thanks Paul , I'll try it.

[umeshunited]

I think Paul may be referring to this. This configuration worked for me.And now I have only one bgp neighborship between Stack and Nexus (2 nexus in vpc).

The diagram is attached.

______Nexus-1______

interface eth1/10
no switchport
ip address 192.168.10.73/24
hsrp version 2
hsrp 100
mac-address 0056.5524.0514
ip 192.168.10.100
!
interface loopback 0
ip address 1.1.1.1/32
!
router bgp 123
router-id 192.168.10.73
neighbor 192.168.10.1 remote-as 111
update-source loopback 0
ebgp-multihop 5
address-family ipv4 unicast
!

______Nexus-2______

interface eth1/10
no switchport
ip address 192.168.10.74/24
hsrp version 2
hsrp 100
mac-address 0056.5524.0514
ip 192.168.10.100
!
interface loopback 0
ip address 1.1.1.1/32
!
router bgp 123
router-id 192.168.10.74
neighbor 192.168.10.1 remote-as 111
update-source loopback 0
ebgp-multihop 5
address-family ipv4 unicast
!

______Stack switch______

interface vlan 100
ip address 192.168.10.1 255.255.255.0
!
router bgp 111
neighbor 1.1.1.1 remote-as 123
neighbor 1.1.1.1 ebgp-multihop 5
!
ip route 1.1.1.1 255.255.255.255 192.168.10.100
!
interface gi1/0/20
switchport mode trunk
switchport trunk native vlan 100
!
interface gi2/0/20
switchport mode trunk
switchport trunk native vlan 100
!

Thank you @Sergiu.Daniluk @paul driver and @Georg Pauwen for your response.

[Sergiu.Daniluk]

Hi @umeshunited 

This is definitely something not supported. Imagine that the stack switch is sending updates to only one vPC peer (due to load balancing of the L2 port-channel), which at a point in time fails (or reloads).  Now your second vPC peer does not have the routing information from the stack switch, as it didn't received any updates so far and boom, your network is impacted. 

You strongly advise you to check some fail-over scenarios before putting this in production:

+ shut down peer-link

+ shut down one link at a time in the vPC port-channel towards the stack

+ reload one peer at a time: first vpc operational secondary, then primary

Stay safe!

Sergiu

[umeshunited]

Sure @Sergiu.Daniluk , will check before putting that into production. 

[umeshunited]

I tried but not able to from neighborship with VIP on nexus.

Please find attached snap.

[paul driver]

Hello
My initial suggestion was on based the nexus in a vpc domain connecting to a cisco stack, However you have since then stated that the nexus switches are not one logical node but two separate physical routed nodes so in that case the you would require two separate bgp peerings towards the cisco stack